Executive brief
A security vulnerability exists in Revive Adserver, a popular open-source ad serving platform. An attacker can create a username containing malicious code which, when viewed by an administrator in the system's audit logs, executes automatically. This could allow an attacker to perform unauthorized actions with administrative privileges or compromise the administrator's session.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in Revive Adserver versions 6.0.6 and earlier. The vulnerability is located in the audit log component, which fails to properly sanitize or escape usernames before displaying them in the audit log details view. An attacker can register or update a profile with a malicious JavaScript payload as the username. When an administrative user views the audit log entries associated with that user, the payload executes in the context of the administrator's session. This is tracked as CWE-79 and has been addressed by adding proper output escaping to the audit log details.
Affected products
- Revive Adserver <= 6.0.6
Timeline
- 2026-06-23: disclosed
- 2026-06-23: advisory